2f92fb07d82ad221c6e378b95aa014e9_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2f92fb07d82ad221c6e378b95aa014e9_JaffaCakes118
Size

233KB
MD5

2f92fb07d82ad221c6e378b95aa014e9
SHA1

1b52d724ca57b5ee0bfa65005e0c1b615efd7dd5
SHA256

cd434a5eca56f7b2743d1c8b5fb47b31c89d08dbbab47bd232527af1501f92bb
SHA512

e5243e44c6bc85805268d8b27de6cf49e48e91899ea0a079f3d6ea07a8e0c112f95113437cd38a2e9b8b16c69e210511de1f6e5d4afa8990cbf3881ccb43cf11
SSDEEP

3072:ShFW7TX/7r1DNQwUX9hwh8Fz1qF6EKcQprLoxwPx7fLrBmoQz:mW7bzr1DeX9hwh8d46LcQNLHfVQz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f92fb07d82ad221c6e378b95aa014e9_JaffaCakes118

Files

2f92fb07d82ad221c6e378b95aa014e9_JaffaCakes118
.exe windows:6 windows x86 arch:x86

b8d3833c30067a164091743fe3809147

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateThread
GetFullPathNameA
lstrlenA
VirtualQuery
lstrcpynA
SetUnhandledExceptionFilter
OutputDebugStringW
GetModuleHandleW
ExpandEnvironmentStringsA
GetDriveTypeA
InterlockedExchange
SearchPathA
GetModuleFileNameA
GetCurrentThreadId
OutputDebugStringA
GetVersion
MultiByteToWideChar
SetEvent
LoadLibraryW
Sleep
CreateIoCompletionPort
InitializeCriticalSection
SetConsoleCtrlHandler
InterlockedDecrement
GetQueuedCompletionStatus
GetCurrentProcess
OpenThread
TerminateProcess
UnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
DeleteCriticalSection
GetSystemTimeAsFileTime
WaitForMultipleObjects
PostQueuedCompletionStatus
CreateEventW
LoadLibraryA
GetSystemDirectoryW
lstrlenW
GetProcessHeap
HeapReAlloc
HeapFree
HeapAlloc
CompareStringW
GetEnvironmentVariableW
SetEnvironmentVariableW
lstrcpyW
lstrcatW
InterlockedCompareExchange
LocalAlloc
LocalFree
RaiseException
HeapDestroy
HeapCreate
GetSystemInfo
ReadProcessMemory
SetHandleInformation
GetModuleFileNameW
GetModuleHandleA
CreateMutexW
ReleaseMutex
GetExitCodeProcess
FreeLibrary
CreateProcessW
GetStartupInfoW
SetThreadPriority
GetThreadPriority
GetCurrentThread
ResetEvent
EnterCriticalSection
GetComputerNameExW
GetProcAddress
SetLastError
GetLastError
GetSystemDirectoryA
LeaveCriticalSection
WideCharToMultiByte
GetComputerNameW
WaitForSingleObject
InterlockedIncrement
GetCurrentProcessId

msvcr80

_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
_wmakepath
_vsnwprintf_s_l
_resetstkoflw
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
setlocale
_purecall
wcstol
wprintf
??2@YAPAXI@Z
strncpy_s
wcstok
strcat_s
_wtol
_vsnwprintf_s
strtoul
??3@YAXPAX@Z
strcpy_s
wcsstr
_wcslwr
strchr
_wcsnicmp
calloc
free
_vsnprintf_s
wcsrchr
memset
_strtoul_l
_sprintf_s_l
memcpy
_wcsicmp_l
_snwprintf_l
_wcstoul_l
_wtoi_l
__CxxFrameHandler3
_wcsnicmp_l
wcstoul
sprintf_s
_wcsicmp
wcschr
exit
_wsplitpath

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCloseKey
RegisterEventSourceW
DeregisterEventSource
ReportEventW
StartServiceCtrlDispatcherW
RegQueryValueExA
RegOpenKeyExA
SetServiceStatus
RegisterServiceCtrlHandlerExW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueExW

ws2_32

WSAStartup
WSASocketW
WSARecvFrom
WSAEnumProtocolsW
getsockname
setsockopt
bind
closesocket
WSASendTo
inet_ntoa
inet_addr
htonl
WSAGetLastError
htons
ntohs
getservbyport
getservbyname
WSASetLastError
gethostbyaddr
gethostbyname
WSACleanup

Exports

Exports

DmpGetClientExport

Sections

.text
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sdbid
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8d3833c30067a164091743fe3809147

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr80

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 221KB - Virtual size: 221KB

.data Size: 512B - Virtual size: 5KB

.sdbid Size: 1KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 221KB - Virtual size: 221KB

.data
Size: 512B - Virtual size: 5KB

.sdbid
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 3KB